4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics[.]exe

General

Target
4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe
Size 232KB
Sample240607-l4acxsef2x
SHA256 669377ee5b9052845d46e9d71a5995cbe316d0c2772bdac135faa6a8bd3d2559
MD5 4c77a4e6b8d3319b4aee2c8d148581c0
SHA1 c43fae01138ecd0bfc72538a0e7563909b6d312f
SHA512 8afff9dd4c4fc3e6a63db7d82df6213536c3a63c70df1a34613c7d81512b96e8996be7a0e87ae0b5877b7618abb91350f0d8653e03a485d1b341f641cf1dbc79
SSDEEP 3072:m1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ai/NjO5xbg/CSUFLTwMjs6oi/N+O7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe

File Explorer

4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe

.exe 232KB

4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe

IMPHASH 1a9fb32cefd2d95c73769ee8a5de8d81
SHA256 669377ee5b9052845d46e9d71a5995cbe316d0c2772bdac135faa6a8bd3d2559
MD5 4c77a4e6b8d3319b4aee2c8d148581c0
SHA1 c43fae01138ecd0bfc72538a0e7563909b6d312f
SHA512 8afff9dd4c4fc3e6a63db7d82df6213536c3a63c70df1a34613c7d81512b96e8996be7a0e87ae0b5877b7618abb91350f0d8653e03a485d1b341f641cf1dbc79
SSDEEP 3072:m1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ai/NjO5xbg/CSUFLTwMjs6oi/N+O7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaPut4 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaNameFile _adj_fdiv_m32 __vbaAryDestruct ord593 ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i __vbaStrFixstr __vbaBoolVarNull _CIsin __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaGet4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaRecUniToAnsi EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var __vbaVarAdd __vbaLateMemCall __vbaVarDup __vbaStrToAnsi ord616 __vbaVarLateMemCallLd __vbaVarCopy _CIatan __vbaStrMove _allmul _CItan __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj

Sharing